Hacker News Reader

Comment by errantspark | Hacker News Reader

I constantly run into this problem, I've used my google voice number for everything for years (yeah it's not a great move but very hard to migrate away from) and a frustrating number of services recently have been rejecting it for verification. I end up having to take the sim out of my laptop and put it in my PinePhone. It's such a hassle. This whole "you're not a human unless you have a phone number" thing sucks. Same thing with having a credit score. You're just assumed to participate in these systems even though there's no mandate to do so or protection for you if you don't.

View on HN

Just a couple of days ago, I signed in to a gmail account using the correct username and password.

Gmail intercepted me and claimed to be worried that they couldn't recognize the device I was using. According to the flow, they wanted me to verify my identity in one of three ways: (1) I could verify the backup email address associated with the account; (2) if unable to do that, I could provide the 2FA code sent to that same backup email address (how would I be able to know this without being able to know what the address was?); or (3) I could provide a phone number -- previously unknown to Google -- on the spot, and then provide the 2FA code sent to that brand-new phone number. (How is this supposed to help them verify my identity?)

I went for option (2), the email 2FA code. After providing the code, I was informed that, before signing in to my existing gmail account, I must also provide a phone number and enter the 2FA code sent to my new phone number.

So I went back and went for option (1), typing in my backup email address. Same thing happened. Because Google "couldn't recognize the device I was using", I was not allowed to sign in to an account I obviously controlled without providing a phone number with absolutely zero authentication value.

I did find a workaround. If you attempt to sign in to an account afflicted in this way in an incognito browser window, Google will, for the moment, allow it.

"Don't be evil" is long gone.

I've actually found it hysterical. The phone number question seems to be for their data mining as well as evidence. But anyone can get into any email address when prompted this way. It is possible to send a text to someone else's phone, the servers connected to phones online are often polluted but many times they are not. You can send a text to those and get the code.

Or of course, just send the code to anyone and SS7 hijack that specific text message. You aren't hacking them, after all, you're hacking yourself or someone else.

> the servers connected to phones online are often polluted

What does this mean?

there are websites or chatbots that will give you a phone number and show you the text responses it receives

I had that happen, too — even after successfully receiving the passcode at my recovery address, and entering it, they still denied login. Presumably it's a bug in their system (being generous), but who knows when they'll fix it, if ever?

I currently have an old (infrequently used) gmail account, with a valid recovery email, that I cannot log in to at all.

I don't have (or want) 2FA set up for it.

I tried an incognito window just now, and same problem ):

>if unable to do that, I could provide the 2FA code sent to that same backup email address (how would I be able to know this without being able to know what the address was?)

I am one of those people using option 2, by virtue of keeping a lot of old email accounts that I have set up to forward to my main account. So I don't usually need to remember which account if was, and just wait for the email to come through from the void

I seem to recall fb doing similar. It's similar to banks or telecom providers requiring a persons home address (or worse: to prove it using a utility bill).

It's especially nice when traveling. I was once asked by a client to do something while I was in other country about 5k km from regular location. Couldn't login to the apps account for this reason (no backup email or phone set). So I didn't do the work.

I suspect it's some work-life balance enhancing thing. :D

I don't really mind, since it also helps me bash Google services in front of my clients who still use them, without being aware of these failure modes.

Personally speaking, it's absolutely a no go service. I can probably handle service loss at home quite fine, but if I relied on google or other services with these "anti-abuse" features while traveling that would be very stressful. I usually print out everything important before departing so I don't rely on any electronics, anyway, because none of it is as reliable and as quickly accessible as a piece of paper or a bunch of cash.

If you look at the gmail login page, you may notice that they specifically recommend you sign in in incognito mode when using a device that doesn't belong to you.

Their expressed policy makes an interesting contrast with their behavioral policy of freaking out and locking you out of your own account if you ever try to sign in on a device they suspect might not belong to you.

And of course, they're godawful at recognizing whether a device belongs to you. They freak out and send me "urgent" emails (on a different gmail account) whenever my phone switches between wifi and the cell network. Responding "yes, that was me" does nothing to prevent this.

I imagine it has nothing to do with security and is more about tracking. A similar failure mode with apple is that I essentially need to own two apple products with the same account to accomplish things that should only need one apple product, like making a free download from the app store.

These features came online not long after there were news articles about journalists being hacked.

The fact that Google is inconsistent about it is probably due to Google generally not being good in UX and frequently making these kind of mistakes where it seems there are multiple teams doing their own things incompatible with each other.

>probably due to Google generally not being good in UX

You misspelled "product lifecycle management." Google's lack of accomplishments in this department is a testament to their research, innovation, and committment to the disciplines of Six Omega (6ω) process strategies.

Can relate on the freak out part. Recently I logged in and generated an app password and it triggered 3 emails per action and to 2 different emails I had as my backup.

I wouldn't rely on printing out cash, that can get you in trouble.

Maybe, but it sure is convenient. ;D

Just had this happen to me with my Microsoft/Minecraft account. I had migrated my mojang account 2 days ago and today I was told that apparently they "detected some activity that violates our Microsoft Services Agreement" and locked my account. They did not explain what the violation was and apparently it would magically go away if I verified my phone number (which they did not have before).

Never doing any buissness with ms again.

>"Never doing any buissness with ms again."

No github for you then ;)

Well, gitlab is way better. Github is the Facebook of developers.

I self host my repositories. In this way I do not care about either. But when I am searching for code Github proves to be very good source. I would not say that projects hosted on Gitlab are any better

Gitlab docs say the absolutely bare minimum of RAM to run it is 4GB. And that's just for gitlab, never mind Postgres. That's something like $70/mo just to host some git repos on a major cloud provider.

And if you're talking about the hosted solution... we use that at work. We have what are effectively outages once a week on average.

I like the way Gitlab as a company is run and I really want to like it but... I use gitea at home and we're actively migrating away from it at work.

>That's something like $70/mo just to host some git repos on a major cloud provider.

Don't use a major cloud provider. That's $20/mo with Digital Ocean.

Okay, host it wherever you're comfortable, but 4GB of RAM is still an absurd requirement for hosting a few git repos.

> gitea

Can confirm that gitea's pretty nice. It's not heavier than a web-based git host should be. I really like that it has a SQLite database option, since that's plenty good enough for low-tens of users and operationally simpler.

CVS and Subversion still exist!

I was not planning to get a paid account there anyway. And regardless I prefer gitlab (due to the ICE stuff).

How does that story have anything to do with being evil, by any stretch of the definition?

Are you insinuating that Google has this convoluted verification flow to intentionally harm people in some way? Or even to intentionally harm privacy or further business goals at users' expense?

Or are you just using "evil" to refer to anything you don't like?

I think that comment refers to Google trying to know more identifiable information about the user: a phone number. Which adds to Google’s collection of private data, susceptible to more profiling and such.

The outcome is that they hold your email / data hostage while escalating their demands for your personal information. That sounds pretty evil to me.

That may not be what they intend, but that is result, regardless.

It’s a false reason to collect more data by holding your Gmail hostage until you provide a phone number. It is a pretty shitty user flow with no benefit except for their data collection.

>Or even to intentionally harm privacy or further business goals at users' expense?

Yes (and obviously).

Google, and other SaaS, have used such dark patterns to collect more user identity data (user profile info is what they ultimately sell - even if sold to advertisers "anonymized", the profile is richer and more worth the more data they have on you).

What never seems to come up is that as far as ads are concerned and with the amount and kinds of data that these companies are and have been collecting, your name is worth zilch. "Anonymized" is a red herring.

> How does that story have anything to do with being evil

Google forcing you to enter a phone number is dishonest/hostile and has absolutely not the slightest to do with any desire to make your account more secure.

It's basically just Google holding your account hostage to get your phone number.

FB were caught using 2FA phone numbers for 'evil' purposes.

https://www.eff.org/deeplinks/2019/07/fixed-ftc-orders-faceb...

As noted in the parent, in the given scenario the phone number provides absolutely no improvement in security or verification that the person who enters the phone number is actually the owner of the account. At best, granting Google the benefit of the doubt, it is security theater.

So, since it isn't effective for its stated purpose, are there other reasons it could be in place?

It's not security theater, they don't verify whose phone number is provided. Whatever number they get is used to unlock the account.

That's what would make it "security theater" as opposed to "security".

Once upon a time not long ago, I got off from my flight into a foreign country (I don't have a SIM card that would work there). I turned on my wifi and was delighted to see they had a public network you can use. There was a captive portal, and the only sign in options (besides using a local phone number) were Facebook and Google. I chose Google, and entered my id and password. Google promptly went into the "sus" mode as you described.

Now I can't use option 1 or 2 because I don't have internet access until Google approves my sign in. I can't use option 3 because I don't have a SIM card that would work locally. Thankfully Facebook login worked.

That's when you turn on the DNS tunnel (https://news.ycombinator.com/item?id=7619259 ). If they somehow detect that and try to block, change your MAC and repeat. Those bastards deserve it for trying to force users into megacorps' services.

Wow that's something devious!

This happened to me years back. What would you say to the argument that it's to protect users from identity theft

There's a workaround to fix an account afflicted this way, use a yubikey to add as a security key and then add a 2fa through the google authenticator standard (which works with 1password). Once that's setup google will never ask for your phone number again.

I had this problem this week too. I have a secondary Gmail account that is forwarded to my main one. I tried to login to it, they demanded a phone number (even though I do have access to the backup email), and wouldn't let me in because the only number I have is one that's already in use on my main account. I guess now you need one unique fully-functional phone number for ever Google account you have?!

I think you can verify 6 Google accounts with a single number.

Hmm. I'm sure I don't have that many, and it told me I couldn't use that number, but maybe it was a temporary issue. I haven't tried again...

Never ever ever ever give your phone number to Google for verification or authorization. People just don't understand how easy it is to find someone's phone number and then steal it for long enough to steal e.g. emails. Has happened, will happen etc. Like ssn, phone numbers were never made for this purpose. In fact phone numbers and services (e.g. SMS) are just the front end and are setup to be easy to redirect.

We had incidents in the past just because the colleague had given the number to Google and those were corporate accounts.

Every time a service moves to SMS or phone calls for 2FA a cry can be felt across the universe by any security engineer/cryptographer.

If you are a person responsible for this: please don't. If my antiquated bank that is insured and doesn't really care can understand this, so can you, if you care just a bit.

What even more sucks that you need to first set up phone 2FA before you can enable TOPT. You can remove the phone number afterwards, but why make it so complicated?

Because they want your phone number

Is it really that easy to steal a phone number and/or intercept SMS messages? Isn't the SIM supposed to hold all sorts of secrets to prevent that?

It varies by country and the US is not very secure. In a lot of technically more secure countries social engineering and corruption are available for a determined attacker.

> Isn't the SIM supposed to hold all sorts of secrets to prevent that?

The process has a security hole by design: SIM cards can get damaged/lost (usually with the phone) and you wouldn't want to lose your number just because you lost your phone or damaged your SIM card by accident. This hole is typically exploited by attackers after they have identified a high-value target. You basically outsource the control over your account to a telco employee.

I had happen after a promotion that changed my LinkedIn title to something more prominent.

Still can’t prove what happened but someone ported my number from my carrier to Sprint and it took easily 18 hours to undo it. And it required convincing sprint, which I had no affiliation with, that the original transfer was not intended, and that yes I want to reverse it out.

Crazy painful.

I don't think it's down to the SIM. It's more they call help at the phone company and say "hi I've lost my phone, number 0123123. Could you transfer it to my new handset with another SIM in." Or similar. I had my one (with Three UK) transferred to some random fraudster this year. I got it back but it was a pain and potentially dangerous. In fairness to Google they didn't manage to get in to that.

Suggestion to phone companies: When receiving such requests email and text the user saying "we've had a request to transfer your number, contact us if not you" rather than just cracking ahead.

High level government members were hacked in Brazil using spoofed numbers to access voicemail. No social engineering, just bad systems.

> Never ever ever ever give your phone number to Google for verification or authorization.

You literally do not have a choice, last time I checked you had to setup SMS 2FA first. Once you’ve done that you can setup a better method and remove the SMS, but you have to remember to do it.

> If my antiquated bank that is insured and doesn't really care can understand this, so can you, if you care just a bit.

My bank certainly has not gotten that memo.

Even if it looks like you can disable it, I wouldn't be surprised at all if they'll still let you recover access with the phone number if you fail to log in enough times. They want people using their accounts, searching and using other Google $ervices.

It shouldn't be an immediate problem if it's really 2FA: if the second factor fails, there's still the first factor. The problem is that many systems use phone as single factor.

When I sign into a Google apps account I have associated with a school about half the time I am forced to go through option (3) whereby I’m asked for a number they can send a SMS to. I am never presented with option 1 or 2. Per the tenant settings which I do not control, 2FA is disabled and users cannot enable it, nor provide a backup email last I checked. Extremely frustrating- especially not being able to use a VoIP number, landline to dial, or set up a more robust TOTP generator or the like. Perhaps the school should codify the requirement for students have cellular service just to enroll, since it’s the de facto case already. sigh

Check your internet connection and Google/Gmail certificates. It looks like you are taped.

I have real anxiety about being locked out from "digital self" someday due to issues like this. Sometimes I really think this just isn't worth it anymore and I'm far too invested in "the Internet".

> if unable to do that, I could provide the 2FA code sent to that same backup email address (how would I be able to know this without being able to know what the address was?)

Two options from the top of my head:

1. you have email forwarding configured so received mails will be delivered to another account. That's generally configured in the settings of the provider (I.e. directly under account settings in Gmail iirc)

2. You have a logged in device which receives mails through an application password. You cannot read it out because it's masked and even if you could, it wouldn't help you because it's only allowed to receive mails, not login.

I don't think this is particularly rare, honestly.

But yes, it is obnoxious.

Wherever I can I set up code generation / TOTP 2FA precisely to avoid lockouts. Then to avoid losing all of those whenever I change/reinstall my phone I opt for the less secure option of storing them in a password manager...

I can't think of another way not to get locked out in case I ever lose my phone.

Google, Paypal and a few others seem to be the worst offenders at "protecting me".

Phone numbers are tied to your identity. You cant buy a mobile sim card without showing your id and the phone number will be registered to your id.

Yep, the latest example was my credit card company rejecting my GV number. They easily have the means to see that I've been using it for 10+ years and it's definitely me. Luckily they wanted my business more than they cared about that policy; a CS droid was able to "force" the system to allow it.

Requiring cell phone numbers isn't about anti-spam or 2FA or anything else these services and sites claim.

It's about linking your account to a real person identity, so they can sell that to someone - either live, or later when they get bought out (privacy policies almost always have a clause that allows them to just fork over all your info to whoever buys the company.) "Where was phone number 111-555-1212 at any point in time" is really valuable these days.

SMS for 2FA is less secure because cellular accounts are almost trivial to take over. Carriers never intended for their accounts to become so important to security. These days you can get a second password added to prevent shipping out a new SIM or transferring the account, but that's bypassable by a cellular store on the corner, and poorly implemented (my carrier just adds it as a CUSTOMER VISIBLE AND EDITABLE comment on my profile. WTF?)

If you get someone's unlocked cell phone or a SIM card, you can get access to their email account, their bank and credit cards...damn near everything. How fast can you lock and wipe your phone if it was ripped out of your hands while you were using it in a public place?

> It's about linking your account to a real person identity, so they can sell that to someone - either live, or later when they get bought out

Yeah, this can't be emphasized enough. Phone numbers are established as universal identifiers. Discord is sitting on a giant heap of personal information including DMs from millions of young people. It is all centralized, both in terms of data, and in terms of accounts (instead of them having to correlate an account between multiple forums, most of which volunteer run and they don't turn over non-public data for money), and also associated with phone numbers. Making multiple accounts for different areas of life is made hard. Beautiful for whoever has access to the data.

Not only discord. Today it's easier to say what chat applications don't use phone numbers than those which do.

It's 100% about linking identities between services. I've had my cell phone number for 25 years. It's basically a lifelong identifier at this point and I constantly have to use it for low value online accounts. I wish I could go back 10 years and get a dedicated phone number for online verification.

The security side is a total lie as well. Your post made me think about the biggest risk for myself and, like many people I know, I put my email address on my lock screen so that if I lose my phone someone can get it back to me. Now it just clicked for me and I realize I need to change that because if I lose my phone someone has everything they need to recover a lot of my online accounts. My Google, Microsoft, Amazon, etc. accounts all use that same email address and all they need to do to perform SMS recovery is put my (unlocked) SIM in another phone.

It’s the new SSN but even less private.

Asking for information for one purpose and using it for another is amazingly user-hostile and abusive, and it's an almost universal practice for technology companies.

I first noticed phone number abuse with facebook, which asks for a phone number for "security" but then uses it to match you with advertisers.

It's the same scam that sites have been running for years where you have to use an email address as a user login, and that address is instantly added to spam lists.

"Sign in with Apple" is hilariously useless since privacy-violating apps can just require a phone number for "security" or "verification" purposes.

> "Sign in with Apple" is hilariously useless since privacy-violating apps can just require a phone number for "security" or "verification" purposes.

Apple is one of the only companies with both the ability and a possible incentive to push back on that behavior. I wonder if they will.

> This whole "you're not a human unless you have a phone number" thing sucks.

Oh it’s even worse than that. I have a land line that I use exclusively for when I’m forced to give a phone number (and also for faxing doctors and lawyers which is apparently still a thing). Many internet forms reject it because it can’t accept text messages. Yeah, that’s the fucking point. I don’t want text messages from your shitty service. It’s still a legitimate phone number you can call. Don’t ask for a phone number if you won’t actually accept a valid phone number! FFS!

Yeah same. ETrade recently changed their phone verification system and can no longer send me a text message to verify my identity. I'm actually ok with that because it forces them to use the security token instead, which they should be doing anyway!

And often I'll run into problems with silently failed messages because they don't accept the number.

I think this is completely different than having a credit score.

I’ve never ‘needed’ a credit score unless I was requesting a line of credit. I’m which case a credit score is better than the alternative where I need to personally know someone that the lender already trusts and trusts their ability to trust other people.

You don’t ‘need’ a credit score but if you want a line of credit then it’s good to have. Otherwise you get the products that they offer to high risk individuals which costs a pretty penny.

A credit score is used as a trustworthiness analog in arenas other than lending. For example renting a house or car, and some phone companies won't give you access to a post-paid plan, all of which can have a stratifying effect. The idea that because I don't take on debt that I am not trustworthy is wrong. I can pay a larger security deposit to offset risk, but often times that's not an option.

I've also heard tell of employers using credit checks to evaluate potential employees though I haven't researched that.

Post paid plans are credit. It’s allowing you to consume goods, then pay for them after the fact.

Sure, it’s short term credit (sub 30 days), but it’s still credit.

I believe that grandparents point was that by not taking on any debt they don't have a credit score which can be verified. You can't verify something that doesn't exist in the first place.

I thought their complaint was that without a credit score, businesses don't see them as 'trustworthy'. The OP separated 'trust' from 'credit score', and says they shouldn't be conflated.

However since all of the OP's examples involved credit (car rental post-pay, phone usage post-pay, etc.) then in those cases trust===credit score. Without a credit score, you're basically asking someone to trust blindly that you'll pay back a debt since there's no track record of your ever paying back debts.

The problem is that I don't have an alternative method of proving my trustworthiness and as a result lose access to some products. Often times prepaid plans are not equivalent to postpaid plans, I can't just put a security deposit on a rental car to offset risk, etc.

It's not goods, though, it's a service. And in general services are not paid up front.

Meanwhile the community is having a big debate over the CoC, deciding what exact wording they should use to say "be nice and include everyone".

Why just communities be forced to accept everyone? Or even be nice? When in a group of friends we can often times not “be nice” however because we know each other, we understand it comes from a place of love. Perhaps it’s a military background thing, but exclusivity has its benefits.

Because we're not friends.

> I end up having to take the sim out of my laptop and put it in my PinePhone

Just in case you are not aware, you can receive verification SMS on your laptop as well! On Windows 10 there is a built-in app simply called "Messaging" which shows you all the SMS received on that number. I'm sure something different exists for other OSes.

This is what I do when asked for a verification number and there is absolutely no way around it, I just put the phone number of my laptop's SIM card, that way I don't have to worry too much about spam too because I will never use that number in a real phone.

There are laptops with SIM card slots?

Sure, WWAN modems are not only a thing that exists inside mobile phones. ThinkPads (and I'm sure other business-oriented brands as well) often (always?) have optional slots for WWAN modems, so you can use them for a mobile internet connection without tethering. I've been using that feature for over ten years now.

I had one around 2009. It even came with Linux.

They seem less common nowadays, since a tablet or tethered phone covers most use cases.

It looks like this: https://www.amazon.com/Huawei-E3372h-153-Unlocked-External-A...

Ah yes, thanks! I have used a similar USB dongle. I was wondering if it was a special built-in tray or slot in the laptop.

My laptop does have a sim tray and an internal modem, the antenna is in the screen. (HP Spectre x360 13" for those curious)

In my older ThinkPad, the SIM was a slot behind the battery. In a later model, it's a tray that has to be opened with a paperclip next to the card reader. The modem itself is a mini PCIe card like they're used for some laptop SSDs and antennas are in the screen like wifi antennas.

Nice, thanks for pointing this out. It's fucking annoying that I'll have to figure out how to install the Windows Store on my computer to get an app that can receive text messages, something that you know, should be available through a pipe/file/tty or some dead simple interface since it's not exactly rocket science to receive 160 characters of text.

But thank you none the less.

I tried to log into the IRS.gov portal, but it says I can't because I don't have any credit score. (I don't have any credit because I'm an immigrant)

I’m sorry you ran into that problem. I ran into the opposite problem, of thousands of fake accounts a day using VoIP phone numbers to create accounts. Almost all of them were fake/abusive when they were investigated manually. Blocking these numbers felt like the sensible thing to do, because it made the abusive account creators spend more time, money and energy creating their accounts. I’m sorry it impacted you.

Using SMS as a login verification thing is just so irritating. My bank asks me to enter an SMS OTP every time I login to the website. I know my username and password! Let me into my bank account!

They're trying to do that to break 3rd party financial integrations. Not for your security but because they think they deserve to get paid for your data and these other people haven't paid up.

Credential stuffing is a widespread problem. Im sure everyone on HN uses a password manager and different passwords for every service, but many people don't.

It's makes a lot of sense for a high-value target like banking to require 2FA, but SMS is the worst way to do it.

How does this work for Fi users?

I've had a Google Voice number for so long it's the only voice number I have these days. I can't say it's a recent experience that it doesn't work with certain things though it has been a recent experience the things are aware it doesn't work and will alert you. Overall though I've yet to run into anything I couldn't use an alternative method for authentication be it luck (e.g. got into Discord before they required phone numbers) or email or calls being a thing (and working when text doesn't).

Ironically the biggest PITA I had was when I decided to migrate my primary cell number to Google Voice it was my fallback contact number. Thankfully I only ran into that as an issue once and was able to get back in to set up Google Authenticator (which was also new and hip at the time).

I'm not sure if there are any issues on Google Fi, since they're an MVNO, so identical to any other cellular network.

As one point of anecdata, the IRS refused to honor my Fi phone plan because it didn't have my name and mailing address registered on it (or at least to their satisfaction). I don't know if they still require a post-paid cell phone plan for their auth scheme or not, because I gave up trying to make it through after about 6 months of requesting magic codes through the USPS

Anyway, that's a lot of words to say "MVNO" is for sure not identical to "any other cellular network" for a certain class of interested parties, in the same way that pre-paid credit cards are not the same as other credit cards

Isn't it a shame how the world got Google Voice backwards? The savvy among us saw it as a way to present our one true phone number/identity to the world, and have options for different back end phones and services we could use. Cell phones, land lines, Hangouts, computer voicemail, all that. But the average schmoe sees Google Voice as a way to get multiple disposable numbers to sacrifice to spammers and bar hookups and commit minor fraud. So it became useless for its main purpose: being your phone identity.

Every one used to use your social security number instead to uniquely identify people but that was made illegal because of the many problems this caused. But company's want a unique identifier for people. Now that everyone has cell phones people never change their phone number so it is a great unique identifier that is legal to use. Not enough edge cases, yet, like yours too worry about. Maybe it will be made illegal in the future.

It's never been made illegal to use, or even ask for, an SSN.

You can refuse to provide it (unless it's required for tax/employment purposes) but whoever's asking can then just refuse to transact with you.

Thanks for the info. I guess I remembered when companies stopped printing out social security numbers on everything (badges, informational letters, etc.) and using them generally due to, probably, this California law[1].

[1]https://www.kmm.com/articles-195.html

I had been using my gv number for 9 years for everything as well. I recently ported it out of gv into my mobile carrier since no one knew my carrier number and I was running into too many annoying voip restrictions. So far I don’t miss gv.

Wait what? You literally put a sim card into a phone for it to be treated as a cell number? Thats odd and interesting to me how does that work?

The SIM has its own phone number, so when they put it in a phone they can do "phone" things like make calls. In their laptop it's just for data.

Or to be really pedantic, 'is currently assigned a particular' phone number.

Since you can change phone number without changing SIM (I don't know if it's global, but in the UK you just text a certain number for a transfer 'PAC' code) and clone them.

It's harder than that in the US, but it's possible. Mostly it depends on the carrier's policy.

Or SMS. Calls may also work, depending on the modem.

For calls and sms you'd need a client configured for that modem. I think this is what callcenters use?

SMS are easy, you can do that with AT-Commands. Voice calls, I don't know, haven't tested that. ModemManager has support for it though, and for SMS.

https://github.com/freedesktop/ModemManager/blob/master/NEWS

I don't understand, isn't that how SIM cards are supposed to work ?

Instead of "phone" do you actually mean "laptop"? Interfacing with a SIM through a computer seems pretty Futuramaistic to me. How does _that_ work?

My laptop has a built in cellular modem, I find that being connected to the internet constantly is much more useful in a laptop form factor. Phones mostly just try to serve me ads in invasive ways and I'm not here for it.

AFAIK cell modems generally have functionality to send/receive SMSs, and you should be able to do that with the right software.

Completely agree about the walls of commercial surveillance closing in though.

Yeah, I'm sure it's possible to do so, but unfortunately my BIOS locks me into the OEM modem, there is no linux driver for it and the windows one is not documented so no luck for me in that regard. At some point I'll pour some more sweat into it and try to unlock the bios or something but sadly for now this functionality that my computer absolutely has is unavailable to me.

Same with getting NMEA sentences off the GPS, I have to use windows' idiotic location API for that. 9600 baud serial worked just fucking fine, I don't understand why that isn't available as well. It's so annoying that I have to fight this hard for functionality my hardware already has.

It doesn't have some AT capable "serial" port avaiable? A bit surprising.

Whatever comes with should work mostly fine, whitelist unlocks are for those didn’t option a WWAN. All WWAN modems are same, usually they have 3-5 serial ports for modem control, data, debug, and NMEA. My hunch is your ttyS2 takes “GPS enable” command and it’ll start murmuring it on ttyS4.

Refs:

https://whirlpool.net.au/wiki/sierra_advanced_gps

https://forum.openwrt.org/t/problem-accessing-gps-data-from-...

https://gitlab.freedesktop.org/mobile-broadband/ModemManager...

None of the TTYs that Windows exposes will even let me connect (access denied error even as admin) and there is no Linux driver, or maybe there is now with very recent kernels?[0]. It would surprise me if it worked well but I will spend some hours to find out soon. Intel/Fibocomm don't provide support for their modems except to OEMs afaik and I don't see any mention of successful connection under linux w/ my modem. (Fibocom L860-GL/Intel XMM 7560) around the internet. I have tried with some other LTE modem (model forgotten) in the past and I wasn't able to see it under Windows or Linux at all.

[0] https://www.phoronix.com/scan.php?page=news_item&px=Intel-M....

Use USB-Mode.

[0] says it also supports MBIM which is supported ootb with ModemManager and somewhat recent kernels. If your BIOS does not allow this, you probably need to tape over the PCIe-Pins with some non-conductive tape.

[0] https://fccid.io/ZMOL860GL/User-Manual/Users-Manual-3993200....

What device?

An increasing number of tablets and computers offer LTE. It was an option when I got my last gen iPad Mini, though I didn't need it.

> You literally put a sim card into a phone for it to be treated as a cell number?

Well of course -- the SIM is the (as others have pointed out, "currently assigned", yada yada) phone number. So what else would any device with a working SIM slot be treated as, than a cellular device?

Reply on news.ycombinator.com